Analysis of intrusion detection systems

Abstract

As information technologies progress further, the number of vulnerabilities and threats to various data processing systems increases, creating a need for specialized security tools to ensure proper systems functioning and intrusion prevention. A promising area of rapid growth within the field of information security is cyberattack detection and information systems intrusion prevention of unauthorized party access. To identify network intrusions, intrusion detection and prevention systems use modern methods, models, controls and integrated technical solutions that can remain effective when new or modified types of cyberthreats occur. In general, whenever new threats and anomalies are generated by attacks with unidentified or vaguely defined properties, these tools do not always remain effective and require extended time resources to adapt to aforementioned security gaps. Thus, intrusion detection systems must be continuously researched and refined to ensure their effective operational continuity. Such systems include specialized software that is designed to detect suspicious activities or information system intrusions and take sufficient measures to prevent cyberattacks. Source analysis has shown that the issue of rapid detection of exploits and anomalies is a major concern for modern information systems and networks. Most papers only include a partial analysis and classification of intrusion detection systems, and provide a general description of corresponding controls that does not address their wide variety and does not include a required set of characteristics needed for an integrated assessment of such systems. Therefore, the paper presents a generalized analysis of intrusion detection software using a defined basic set of characteristics (Cyberattack Category, Adaptivity, Detection Methods, Management, Scalability, Observation Level, Cyberattack Response, Securityand Operating System Support), which will provide certain options when choosing such tools and developing for them the most efficient security mechanisms possible for mitigating cyberattack impacts.